CVE-2026-92522: ACPI: processor: validate MADT IOAPIC entry bounds
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processor: validate MADT IOAPIC entry bounds
The IOAPIC hotplug lookup parses both MADT and MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generic header. The MAT path likewise passed a generic header to the IOAPIC helper.
Validate that a current record has a complete generic header, that its declared length is contained in the available record range, and that a typed IOAPIC record contains the full fixed IOAPIC body before reading its fields. Use the same relation for both MADT and MAT provider paths.
Event History
Frequently Asked Questions
What condition is required to reach the vulnerable parsing behavior?
The IOAPIC hotplug lookup must process MADT or _MAT ACPI records that are incomplete or whose declared subtable length extends beyond the available record range. A typed IOAPIC record that lacks its complete fixed body can also reach the unsafe field-reading path.
Are both MADT and _MAT ACPI table sources relevant?
Yes. The issue affects the MADT walk and the _MAT provider path used by IOAPIC hotplug lookup. The resolved code applies the same record-boundary validation relationship to both paths.